[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 16 17:48:44 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4006fce3 by Moritz Muehlenhoff at 2026-10-16T18:48:26+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1272,14 +1272,17 @@ CVE-2026-100350 (kin-openapi is a Go project for handling OpenAPI files. From 0.
NOTE: https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f (v0.146.0)
CVE-2026-100349 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146 ...)
- golang-github-getkin-kin-openapi <unfixed>
+ [trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
NOTE: https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459 (v0.146.0)
CVE-2026-100348 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
- golang-github-getkin-kin-openapi <unfixed>
+ [trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
NOTE: https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b (v0.145.0)
CVE-2026-100347 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
- golang-github-getkin-kin-openapi <unfixed>
+ [trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
NOTE: https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3 (v0.145.0)
CVE-2025-68404 (A time-of-check time-of-use (toctou) race condition vulnerability has ...)
@@ -7205,6 +7208,7 @@ CVE-2026-110238 (Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization
NOT-FOR-US: Rapyd Admin
CVE-2026-110237 (Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the s ...)
- vifm <unfixed> (bug #1150939)
+ [trixie] - vifm <no-dsa> (Minor issue)
CVE-2026-110236 (KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection v ...)
- dolphin <unfixed> (unimportant)
NOTE: Not considered a security issue by upstream
@@ -8395,9 +8399,11 @@ CVE-2026-79607 (During Xenstore live update the state record for a Xenstore watc
NOTE: https://xenbits.xen.org/xsa/advisory-514.html
CVE-2026-XXXX [GHSA-w6x2-f5m4-xw82: Arbitrary command execution via bash arithmetic expansion on unvalidated layout size in fzf-tmux (-l/-u attached value)]
- fzf <unfixed>
+ [trixie] - fzf <no-dsa> (Minor issue)
NOTE: https://github.com/junegunn/fzf/security/advisories/GHSA-w6x2-f5m4-xw82
CVE-2026-XXXX [GHSA-7rj6-7pqx-v7rm: Predictable FIFO path in zsh completion allows local symlink attack / arbitrary file overwrite as the victim user (_fzf_feed_fifo)]
- fzf <unfixed>
+ [trixie] - fzf <no-dsa> (Minor issue)
NOTE: https://github.com/junegunn/fzf/security/advisories/GHSA-7rj6-7pqx-v7rm
CVE-2026-9268 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
@@ -8809,17 +8815,22 @@ CVE-2026-109598 (Frappe Framework before 15.120.0 and 16.x before 16.33.0 contai
NOT-FOR-US: Frappe
CVE-2026-109597 (Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripti ...)
- hugo 0.167.0-1
+ [trixie] - hugo <no-dsa> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-wcpj-vcvm-j4pg
CVE-2026-109596 (Hugo from v0.162.0 before v0.167.0 contains an improper link resolutio ...)
- hugo 0.167.0-1
+ [trixie] - hugo <not-affected> (Vulnerable code not present, only affects 0.162 and later)
+ [bookworm] - hugo <not-affected> (Vulnerable code not present, only affects 0.162 and later)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-6c8w-mpp8-9w47
CVE-2026-109595 (Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerabil ...)
- hugo 0.167.0-1
+ [trixie] - hugo <no-dsa> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-r4xx-89rf-5424
CVE-2026-109575 (In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enter ...)
NOT-FOR-US: HAProxy Data Plane API
CVE-2026-109574 (Hugo before v0.167.0 contains a path traversal vulnerability in css.Sa ...)
- hugo 0.167.0-1
+ [trixie] - hugo <no-dsa> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-3jfr-vjcq-7jvf
CVE-2026-109573 (phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMy ...)
NOT-FOR-US: phpMyFAQ
@@ -11253,6 +11264,7 @@ CVE-2026-108554 (PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side
NOT-FOR-US: PDFMathTranslate
CVE-2026-108553 (OpenRefine through 3.10.1 contains a cross-site request forgery vulner ...)
- openrefine <unfixed> (bug #1150650)
+ [trixie] - openrefine <no-dsa> (Minor issue)
NOTE: https://github.com/OpenRefine/OpenRefine/issues/7999
CVE-2026-108551 (openapi-typescript-codegen through 0.31.0 contains a code injection vu ...)
NOT-FOR-US: openapi-typescript-codegen
@@ -12166,6 +12178,7 @@ CVE-2026-102916 (A reachable assertion in the illumos bhyve instruction emulator
NOT-FOR-US: illumos
CVE-2026-102554 (Allocation of resources without limits or throttling (CWE-770) during ...)
- guava-libraries <unfixed> (bug #1150495)
+ [trixie] - guava-libraries <no-dsa> (Minor issue)
NOTE: https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
NOTE: Fixed by: https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe (master)
NOTE: Fixed by: https://github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc (v33.7.2)
@@ -12426,6 +12439,7 @@ CVE-2026-62127 (Improper Neutralization of Input During Web Page Generation ('Cr
NOT-FOR-US: WordPress plugin or theme
CVE-2026-61801 (The `github.com/moby/sys/user` package provides Go utilities for parsi ...)
- golang-github-moby-sys 0.0~git20260904.79376e0-1
+ [trixie] - golang-github-moby-sys <no-dsa> (Minor issue)
NOTE: https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
NOTE: https://github.com/moby/sys/pull/221
NOTE: Fixed by: https://github.com/moby/sys/commit/2c56c3d5d089bfa66d01b6c0bb69428e9d5d18c5 (user/v0.4.1)
@@ -33073,6 +33087,7 @@ CVE-2026-90951 (The Paid Membership Subscriptions WordPress plugin before 3.1.0
NOT-FOR-US: WordPress plugin
CVE-2026-89425 (UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-cor ...)
- jackson-core 2.18.11-1 (bug #1148826)
+ [trixie] - jackson-core <no-dsa> (Minor issue)
NOTE: https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf
NOTE: https://github.com/FasterXML/jackson-core/pull/1698
NOTE: Fixed by: https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3 (jackson-core-3.2.3, jackson-core-3.1.7, jackson-core-2.22.3, jackson-core-2.21.7, jackson-core-2.18.11)
=====================================
data/dsa-needed.txt
=====================================
@@ -20,7 +20,7 @@ activemq
amd64-microcode (carnil)
Coordinating with maintainer DSA/bookworm-pu and sync with mitgations in src:linux
--
-apache2
+apache2 (jmm)
move to 2.4.69 after a grace period to wait for regressions
--
bouncycastle
@@ -77,6 +77,8 @@ jupyterlab
--
kitty
--
+libheif
+--
libnet-idn-encode-perl (carnil)
--
libreswan
@@ -135,7 +137,7 @@ python-authlib
--
python-django
--
-python-git
+python-git (jmm)
Emmanuel Arias is proposing to prepare an update for open issues
--
python-msgpack
@@ -179,7 +181,7 @@ weechat
--
wordpress
--
-xen
+xen (jmm)
--
xorg-server (carnil)
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4006fce337c5857a4e9c72d636d96a8b43920626
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4006fce337c5857a4e9c72d636d96a8b43920626
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/fc4c59f6/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list